Issue 975

[zchisholm]

Title: Refactor Campaigns Route to Enforce Least Privilege and Limit Data Exposure

Issue: #957

Description:

This pull request refactors the GET /campaigns route to apply the Principle of Least Privilege and limit data exposure. The changes ensure that only the necessary fields (name, startDate, and endDate) are returned to API consumers, minimizing the risk of exposing sensitive information.

Changes Made:

• Refactored the GET /campaigns route to return only specific fields from the Campaign collection.
  • The fields returned are name, startDate, and endDate.
  • This limits data exposure and adheres to the Principle of Least Privilege by reducing the risk of exposing unnecessary data.

Before Refactor:

The GET /campaigns route returned all fields from the Campaign collection, exposing more data than necessary:

const campaigns = await Campaign.find({});
res.status(200).json(campaigns);

After Refactor:

Now, the GET /campaigns route only returns the name, startDate, and endDate fields:

const campaigns = await Campaign.find({}, 'name startDate endDate');
res.status(200).json(campaigns);

[github-actions[bot]]

[github-actions[bot]]

Hello there, thanks for opening your first Pull Request. Someone will review it soon.